Canada Revenue Agency finally supports Authenticator codes (1.Viewing)

Thanks for sharing. Honestly, thought this would never happen. Canadians seem content with SMS. Time-based one-time passcodes are a meaningful improvement though, now with built-in platform and browser support (in addition to the “authenticator apps” CRA says you must have).

Passkeys when?!
 
MapleDots said:
[…] it's been one of my complaints logging into the cumbersome revenue Canada site.
Click to expand...
If you delete all the SMS phone numbers, you avoid CRA asking if you want to use SMS or TOTP every time. Not a bad implementation (but as thread mentions, not perfect).
 
I look at authenticator as being one of the most secure ways to login, I use it for

  • Dan.com
  • GoDaddy
  • Bitwarden
  • Wise.com
  • Bodis.com
  • DynaDot.com
  • WHC.ca
  • Stripe.com
  • Google.com
  • going to try it for the CRA
 
andrewe said:
If you delete all the SMS phone numbers, you avoid CRA asking if you want to use SMS or TOTP every time. Not a bad implementation (but as thread mentions, not perfect).
Click to expand...

Here is the context

Canada Revenue Agency is following the industry standard otpauth specification, but not very precisely, which leaves room for improvement.

1 . “authenticator app”

Unfortunately, CRA is using the term “authenticator app” and is wrong here: “If you have not already downloaded a third-party authenticator app on your device … you will need to do so to use this option.”

Not true! Your platform or browser’s built-in support works just fine — without an app. I built otpauth:// demo to demonstrate this existing support (and share best practices) but…

It’s hard to fault CRA though. While Apple’s
@rmondello
has argued (Ricky Mondello » Twitter’s Decision to Limit SMS 2FA is Dangerous) that “authenticator apps” are not the right framing for tim
Click to expand...
 
I added that recently too. Even better would be FIDO U2F security keys, though (like Yubico Keys, Google Titan, etc.)
 
You must log in or register to reply here.

Sponsors who contribute to keep dn.ca free for everyone.

Sponsor
CanSpace
CIRA
FullHost
WHC
Donors (6)

Sponsors who contribute to keep dn.ca free.

Members who recently read this topic: 14

Back
Top Bottom